guloader | 9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4

Analysis

max time kernel
48s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:32

Target

9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4.exe
Size

128KB
MD5

b33657fd180bdaf5cd57a82c348f86ca
SHA1

80b48cfab2d5df0927381c18b13a3d6c4fc55611
SHA256

9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4
SHA512

8691aac89ff7c0080bce9c6c3133bc0d6cc0274daa8eb8d3427eb6929a4201d83c2108185d725183d5641c273e5992469575567a402129a4c731a078291e3a21
SSDEEP

1536:uWWTwV4fVhuN3yFBm1H/1zT+yLUcAeOud1h+OhDQTcuxVQwV4MjW:2wVUPE34B4HZntAJud1h+OhMTcQqwV

Score

10^/10

Family

guloader

https://onedrive.live.com/download?cid=802AC8A73EEC8C8E&resid=802AC8A73EEC8C8E%21109&authkey=AHIyNVT0zJMFfdA

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1884-56-0x0000000000280000-0x000000000028C000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4.exe

pid process

1884 9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4.exe

pid	process
1884	9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4.exe

C:\Users\Admin\AppData\Local\Temp\9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4.exe
"C:\Users\Admin\AppData\Local\Temp\9e94446daa31307c1f06f8d452ace86c16c1306eb32c16a083fc30c7f1d6ccc4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1884

memory/1884-56-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/1884-57-0x0000000077390000-0x0000000077539000-memory.dmp

Filesize
1.7MB

Download